Privacy Policy

Last updated 28 October 2026

This policy explains how Phantom Dialogue AI Pty Ltd (ABN 94 670 034 607) ("we", "us") handles personal information in connection with:

• the website at ai-gagement.com and its waitlist (the "website"); and
• AI-gagement, our service for managing social media accounts, at app.tryaigagement.com (the "service").

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for people in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR).

1. Who this policy is about

It covers four groups of people, and we handle each differently:

• Visitors to the website, and people who join the waitlist.
• Users: people who sign up to the service and use it.
• People who interact with an account managed through the service: for example someone who comments on a post, sends a direct message, or mentions an account that one of our customers has connected. You may never have used AI-gagement yourself. Section 5 is written for you.
• People who write to us.

2. Our role

For Users' own account information, the website and the waitlist, we decide how the information is handled, and we are responsible for it (under the GDPR, the "controller").

Inside the service, our customers work in workspaces we call Organizations. Each Organization decides which social media accounts to connect and what to do with the messages they receive. For the content of an Organization's workspace, including the comments and messages people send to its connected accounts, the Organization decides how that information is used, and we handle it on its behalf (under the GDPR, we are its "processor"). If you want to know what a particular Organization does with your information, ask that Organization. You can also write to us and we will pass your request on or help where we can. The terms on which we process it for an Organization are in our Data Processing Addendum.

3. What we collect, and where it comes from

If you visit the website or join the waitlist

• Waitlist: your email address. Nothing else.
• Visiting: nothing. The website sets no cookies, stores nothing in your browser, runs no analytics or tracking tools, and loads nothing from anyone else. Our website keeps no log of visits. Our hosting provider, Railway, handles your IP address to deliver each page and keeps a short record of each request, including that address, for running and securing its platform. We do not use it to identify or track you.

If you use the service

Your account. Your first and last name, your email address and your password. We store the password only as a one-way hash, so nobody, including us, can read it. If you turn on two-step sign-in, we keep the secret your authenticator app uses, encrypted, and single-use recovery codes, stored only as one-way hashes.

Your workspaces. The Organizations you belong to, your role in each, invitations you send or receive (including the invitee's email address), and the Organization's name and time zone.

Social media accounts you connect. When you connect an account on X, Facebook or Instagram, the platform gives us:

• the account's identifier, handle and display name;
• the access tokens that let us act for the account, which we store encrypted; and
• the permissions you granted.

We also keep the account's follower count over time.

Your content. What you and your colleagues create in the service: posts and their versions for each account, scheduled times, images and videos you upload, notes, approval decisions and the reasons given for them, replies, automation rules, the account's writing voice (see section 4), and monthly reports.

Performance data. Figures the platforms report for your published posts, such as impressions, likes, replies and reposts, and your follower counts.

Activity records. A record of security-relevant actions, such as changes to members and roles, approvals, and the AI's actions. Each record shows who acted, in which Organization, on what, and whether it succeeded. It includes the person's name, email address and role at the time.

Notifications we show you inside the service, and whether you have read them.

What we do not collect. The service does not record your IP address, device, browser or location in its database, and it uses no analytics, advertising or tracking tools.

If someone interacts with an account managed through the service

See section 5.

If you write to us

Your email address, your name if you give it, and what you write.

4. How the service uses AI

AI-gagement's assistant, the Co-pilot, uses AI models run by OpenAI and Google to:

• build a description of an account's writing voice from posts the account has published on its platform. We read those posts for the purpose, keep the description and a short sample, and delete the posts themselves within 30 minutes, when the build ends;
• describe images, GIFs and videos attached to posts and messages, including any text in them and, for video, its speech and sound, so the Co-pilot can take them into account;
• classify the sentiment of comments and messages (for, neutral or against), with its confidence and the reasons for it;
• draft replies to comments and messages, in the account's voice; and
• write monthly reports from the account's performance figures.

To do this we send the model provider what each task needs. For a reply, that is the message, the earlier messages in the conversation, the sender's handle, descriptions of any media, the voice description, and any instruction a User typed. For media, it is the image, GIF frames or video itself. Reports are written from figures only.

What the AI does not do:

• It does not decide anything final about you. A draft reply is labelled as written by the Co-pilot. It is sent only when a User approves it, or when the Organization has set up and switched on an automation rule that allows replies like it to be sent without review. Organizations decide whether to use such rules; they are off unless an Organization turns them on.
• Your information is not used to train AI models. The providers' terms for the services we use say they do not train their models on what we send. They may keep it for up to 30 days to detect abuse, then delete it.

5. If you interact with an account managed through the service

If you comment on, reply to, mention or send a direct message to an account that an Organization has connected to AI-gagement, the service receives from the platform:

• your platform identifier, handle and display name;
• what you wrote, and any images, GIFs or videos you attached; and
• when you wrote it.

The Organization uses the service to read, organise and reply to these messages. The service may describe your media, classify the sentiment of your message, and draft a reply, as section 4 explains. A human at the Organization approves each reply, unless the Organization has switched on an automation rule for replies like it.

We do not collect anything about you beyond what you sent to that account, we do not build a profile of you across Organizations, and we do not sell or share what you wrote with anyone except the AI providers in section 7, to do the work described here.

How long it is kept. Your messages, and the AI's descriptions and classifications of them, are deleted automatically 90 days after you wrote them. The replies an Organization sent you, and a record of the conversation they belong to, may be kept by that Organization for longer.

Your choices. The Organization that manages the account is responsible for your information, so the quickest route is to ask it. You can also write to us at [email protected], telling us the platform, your handle and the account you interacted with. We will pass your request on to the Organization or act on it ourselves where we can. Deleting a comment on the platform itself does not yet delete our copy; our copy is deleted on the 90-day schedule above, or sooner on request.

6. Why we use personal information

We do not sell personal information, rent it, use it for advertising, or share it with anyone for their own marketing. We do not send Users marketing emails without separate consent.

7. Who we share it with

We use these providers to run the website and the service. They handle personal information on our behalf, only to provide their service to us.

Social media platforms. When you connect an account and use the service, we send the platform what you ask us to: posts, media, replies, likes, hidden comments and messages. We currently work with X and with Meta (Facebook and Instagram). What the platform does with that information is governed by its own privacy policy. We will add each new platform here before we offer it.

Inside an Organization. Other members of an Organization can see what you do in it, according to their role: your name and email address, your content, and the activity records.

Others. We may disclose personal information if the law requires it, to protect people's safety or our rights, or to a buyer of our business, who would be bound by this policy.

8. Sending information overseas

The service's data is stored in Australia. Some of it goes overseas:

• the AI providers in section 7 receive what each task needs, in the United States;
• the website is hosted by Railway in Singapore, which handles visitors' IP addresses;
• waitlist sign-ups are held by Formspree in the United States; and
• the platforms you connect receive what you publish and send, wherever they operate.

We take reasonable steps to make sure these providers protect personal information consistently with the Australian Privacy Principles. For people in the EEA or UK, we rely on an appropriate safeguard, such as the European Commission's standard contractual clauses, for each transfer.

9. How long we keep it

10. Your choices and rights

You can ask us at any time to:

• tell you what personal information we hold about you, and give you a copy;
• correct it if it is wrong;
• delete your account and your personal information;
• remove you from the waitlist.

Write to [email protected] from the email address concerned. We will act on your request within 30 days, free of charge. We may need to confirm it is you before we act.

Deleting your account. When we delete your account we remove your name, email address and sign-in details, and your membership of every Organization. Content you created inside a shared Organization belongs to that Organization and stays with it, unless its owner deletes it. If you are the only member of an Organization, we delete the Organization and its content too. Activity records are kept (section 9), because they are the record of what happened; we can tell you what they contain.

Disconnecting a social account. An Organization's owner can disconnect a connected account at any time from the service's Accounts screen, and we delete its access tokens straight away. To stop the platform's access completely, also remove AI-gagement from the account's settings on the platform:

• X: Settings › Security and account access › Apps and sessions › Connected apps.
• Facebook: Settings › Apps and websites, and for a Page, the Page's Business Integrations.
• Instagram: Settings › Apps and websites.

Asking for deletion of data received from Facebook or Instagram. Write to [email protected] with "Data deletion" in the subject and the account concerned. We will delete the data the service received from that account within 30 days and confirm when it is done.

Other rights. If you are in the EEA or the UK you also have the right to restrict or object to how we handle your information, to receive it in a portable form, and to withdraw consent at any time. Withdrawing consent does not affect what we did before you withdrew it.

11. Cookies and browser storage

The website uses none.

The service uses two cookies, both essential to signing in and neither readable by scripts:

• token, which keeps you signed in for up to 24 hours;
• mfa_token, which lasts a few minutes while you complete two-step sign-in.

It also keeps a few settings in your browser's own storage, such as your light or dark theme, the date range you last chose on a report, and a value that protects the step where you connect a social account. These never leave your browser. There are no analytics, advertising or tracking cookies, so there is nothing to opt out of.

12. Keeping it secure

• Everything is sent over encrypted connections (TLS).
• The database and file storage are encrypted at rest. Platform access tokens and two-step sign-in secrets are encrypted again, separately, inside the database.
• Passwords, recovery codes and the links we email are stored only as one-way hashes.
• Each Organization's data is kept apart from every other Organization's by the database itself, not only by the application.
• Signing out ends your session immediately, and changing or resetting your password ends all of them.

A small number of our people can access the service's systems and data, only to operate and support the service, investigate a problem or a breach, or comply with the law.

No method of storage or transmission is completely secure. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as the law requires.

13. Children

The website and the service are not intended for anyone under 18, and you must be 18 or over to create an account. If we learn we hold the account or waitlist details of someone under 18, we will delete them.

14. Questions and complaints

Write to [email protected]. We will acknowledge a complaint within 7 days and aim to resolve it within 30.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the EEA or the UK, you can complain to the data protection authority where you live.

15. Changes to this policy

If we change this policy we will post the new version here and update the date at the top. If a change is significant, we will tell Users by email or in the service before it takes effect. If a change affects how we use your waitlist email address, we will ask for your consent again first.

16. Contact